mirror of
https://github.com/python/cpython.git
synced 2025-08-20 00:32:12 +00:00
bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794)
* bpo-37461: Fix infinite loop in parsing of specially crafted email headers.
Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.
(cherry picked from commit a4a994bd3e
)
Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>
This commit is contained in:
parent
1fc43a3faf
commit
6816ca30af
3 changed files with 12 additions and 0 deletions
|
@ -2690,6 +2690,13 @@ class Test_parse_mime_parameters(TestParserMixin, TestEmailBase):
|
|||
# Defects are apparent missing *0*, and two 'out of sequence'.
|
||||
[errors.InvalidHeaderDefect]*3),
|
||||
|
||||
# bpo-37461: Check that we don't go into an infinite loop.
|
||||
'extra_dquote': (
|
||||
'r*="\'a\'\\"',
|
||||
' r="\\""',
|
||||
'r*=\'a\'"',
|
||||
[('r', '"')],
|
||||
[errors.InvalidHeaderDefect]*2),
|
||||
}
|
||||
|
||||
@parameterize
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue